From c31656bca217d600f709202dc4e4be49989f5c52 Mon Sep 17 00:00:00 2001
From: Fizzlepoof <admin@paccoco.com>
Date: Tue, 12 May 2026 08:20:00 -0500
Subject: [PATCH] feat: add sync-envs-to-secrets.sh script

---
 scripts/sync-envs-to-secrets.sh | 73 +++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 scripts/sync-envs-to-secrets.sh

diff --git a/scripts/sync-envs-to-secrets.sh b/scripts/sync-envs-to-secrets.sh
new file mode 100644
index 0000000..d9deeb2
--- /dev/null
+++ b/scripts/sync-envs-to-secrets.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# sync-envs-to-secrets.sh
+# Copies all .env files from compose stack folders into the git-crypt secrets repo.
+# Run as root on PD. Safe to re-run — overwrites stale copies.
+set -euo pipefail
+
+COMPOSE_ROOT="/mnt/docker-ssd/docker/compose"
+SECRETS_REPO="/mnt/docker-ssd/docker/secrets"
+ENV_DIR="${SECRETS_REPO}/env"
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+info() { echo -e "${GREEN}[+]${NC} $*"; }
+warn() { echo -e "${YELLOW}[!]${NC} $*"; }
+die()  { echo -e "${RED}[✗]${NC} $*" >&2; exit 1; }
+
+[[ -d "$SECRETS_REPO/.git" ]] || die "Secrets repo not found at ${SECRETS_REPO}. Run setup-secrets-repo.sh first."
+[[ -d "$COMPOSE_ROOT" ]]     || die "Compose root not found at ${COMPOSE_ROOT}."
+
+# Ensure git-crypt is unlocked — encrypted files show as binary if not
+if file "${ENV_DIR}"/*.env &>/dev/null 2>&1 && file "${ENV_DIR}"/*.env 2>/dev/null | grep -q "Git crypt"; then
+  die "Secrets repo appears to be locked. Run: git-crypt unlock /root/.git-crypt-secrets.key"
+fi
+
+info "Scanning ${COMPOSE_ROOT} for .env files..."
+copied=0
+skipped=0
+
+while IFS= read -r -d '' envfile; do
+  # Derive stack name from parent directory
+  stack=$(basename "$(dirname "$envfile")")
+  dest="${ENV_DIR}/${stack}.env"
+
+  if [[ -f "$dest" ]]; then
+    # Only overwrite if source is newer or different
+    if ! diff -q "$envfile" "$dest" &>/dev/null; then
+      cp "$envfile" "$dest"
+      info "Updated:  ${stack}.env"
+      ((copied++))
+    else
+      warn "Unchanged: ${stack}.env — skipping"
+      ((skipped++))
+    fi
+  else
+    cp "$envfile" "$dest"
+    info "Added:    ${stack}.env"
+    ((copied++))
+  fi
+done < <(find "$COMPOSE_ROOT" -maxdepth 2 -name ".env" -not -path "*/.git/*" -print0 | sort -z)
+
+if [[ $copied -eq 0 ]]; then
+  warn "Nothing new to commit ($skipped unchanged)."
+  exit 0
+fi
+
+info "Committing ${copied} file(s) to secrets repo..."
+cd "$SECRETS_REPO"
+git add env/
+git -c user.name="Fizzlepoof" -c user.email="admin@paccoco.com" \
+  commit -m "chore: sync .env files from compose stacks
+
+$(find "${ENV_DIR}" -name "*.env" -newer "${SECRETS_REPO}/.git/COMMIT_EDITMSG" 2>/dev/null \
+  | sort | xargs -I{} basename {} | sed 's/^/  - /' || echo "  (see diff)")"
+
+git push
+
+echo ""
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${GREEN}  Done! ${copied} env file(s) synced, ${skipped} unchanged.${NC}"
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+echo "  Files in secrets repo:"
+ls "${ENV_DIR}"/*.env 2>/dev/null | while read -r f; do echo "    $(basename "$f")"; done
+echo ""